CVE-2021-33035

Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10

• CWE-120
• CWE-120

• http://www.openwall.com/lists/oss-security/2021/10/07/3Mailing List, Patch, Third Party Advisory
• https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90fPatch, Third Party Advisory
• https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9%40%3Cusers.openoffice.apache.org%3E
• https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb%40%3Cannounce.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/10/07/3Mailing List, Patch, Third Party Advisory
• https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90fPatch, Third Party Advisory
• https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9%40%3Cusers.openoffice.apache.org%3E
• https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb%40%3Cannounce.apache.org%3E

Published

Sep 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33026The Flask-Caching extension through 1.10.1 for Flask relies …9.8
• CVE-2021-33027Sylabs Singularity Enterprise through 1.6.2 has Insufficient…9.8
• CVE-2021-33031In LabCup before <v2_next_18022, it is possible to use the s…3.1
• CVE-2021-33032A Remote Code Execution (RCE) vulnerability in the WebUI com…10
• CVE-2021-33033The Linux kernel before 5.11.14 has a use-after-free in cips…7.8
• CVE-2021-33034In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c…7.8
• CVE-2021-33036In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2…8.8
• CVE-2021-33037Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.…5.3
• CVE-2021-33038An issue was discovered in management/commands/hyperkitty_im…7.5
• CVE-2021-3304Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow v…9.8
• CVE-2021-33040managers/views/iframe.js in FuturePress EPub.js before 0.3.8…6.1
• CVE-2021-33041vmd through 1.34.0 allows 'div class="markdown-body"' XSS, a…6.1